Re: [saag] can an on-path attacker drop traffic?

Behcet Sarikaya <sarikaya2012@gmail.com> Wed, 02 September 2020 17:37 UTC

Return-Path: <sarikaya2012@gmail.com>
X-Original-To: saag@ietfa.amsl.com
Delivered-To: saag@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id F011B3A0C24 for <saag@ietfa.amsl.com>; Wed, 2 Sep 2020 10:37:15 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.847
X-Spam-Level:
X-Spam-Status: No, score=-1.847 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_ENVFROM_END_DIGIT=0.25, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id rOwU26Mszd_r for <saag@ietfa.amsl.com>; Wed, 2 Sep 2020 10:37:14 -0700 (PDT)
Received: from mail-yb1-xb36.google.com (mail-yb1-xb36.google.com [IPv6:2607:f8b0:4864:20::b36]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2BBC13A0C0F for <saag@ietf.org>; Wed, 2 Sep 2020 10:37:14 -0700 (PDT)
Received: by mail-yb1-xb36.google.com with SMTP id s92so220965ybi.2 for <saag@ietf.org>; Wed, 02 Sep 2020 10:37:14 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:reply-to:from:date:message-id :subject:to:cc; bh=yYezpnV6wWkStdIc1M4NXuVVHTcXwFNUITHMVAsCOhI=; b=L4D2Pui49lAVfMoSqC6iH0pyIDYXlTKwxzoT41WQxt/9X+iHvHfG+SrJxP+XYD/UKu Xoda6t+JjKNDrksjSkWmyg/5d8LtOq9XypQDAYsOKOWr+LKq0ZzQWvq7hV0MvxMvvcEW +a6VqixGQwZCm+6FKUZrgKHeVJWHOEuViNd2mQYUwlSMEe+GWkNmksUyT3YQOdjrvq7I 2rfznSmOhY3ZoLOB1HQciKYn4QdM/OiBBtDeEixDrZT9nVliED0JpkpJ9jXmcAfE5FSi pVm2Kb6aXLW1s9/x58cRXH0mwVLBDoasbtUp0Dm0W/jwvy4Wt7CCaxa9rIfbMzCyZU76 PbYA==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:reply-to :from:date:message-id:subject:to:cc; bh=yYezpnV6wWkStdIc1M4NXuVVHTcXwFNUITHMVAsCOhI=; b=mRJOYKTzx8MjBqCbW/Hc0yxbsztSOQK3pz7IruO3yz+POCLDPrHukf/ByUXWnfOUsW +2ot1aGvqVdVBdCDDAQmBOPMQSBUIZh2pe9C/z39rGtHA5AR6uO8Be7rjiMTHs5nomj9 pRlLPVX+15fUPHDRye13m/0CyXV3W8wMWPcexg0VZOq7Xuhz/nE3Tp8alQ6ZYKAyRq4O 6fvLanCj6e9h78nSV86VQx833rS21E2j9qOsyOt627+kfb3ntvTBBCckWGQn0ebZrLoo 9Wy6LH8xtlzpRAtX5a+QPWl6Mpl41LEY6qVnkTA5IuDXKWAPOF8TaeW/TD7EOM9y7l7c 6RRw==
X-Gm-Message-State: AOAM5328nbyueTtaanWiC8KFrlCZEuj+E9NW9WyNIIpp6Yb1zmSMq9jK 8uHjM2qP2u7PQ5W8+FnQygWdfN5CV1od2pyhEq0=
X-Google-Smtp-Source: ABdhPJzECm1iGk7RbNPXaczkOmo5LR88AJom24gOfB/DZ2D502b8xvYVCW0K0ij0zWtPjlFFy1txC1RS7fgBbBeiwJY=
X-Received: by 2002:a25:a85:: with SMTP id 127mr11467372ybk.327.1599068233324; Wed, 02 Sep 2020 10:37:13 -0700 (PDT)
MIME-Version: 1.0
References: <4645.1599064072@localhost> <CABcZeBNWf=8TU_tJK5rKyh_Veaa5L0jhV9qkvL7M-k-BaNYoRA@mail.gmail.com>
In-Reply-To: <CABcZeBNWf=8TU_tJK5rKyh_Veaa5L0jhV9qkvL7M-k-BaNYoRA@mail.gmail.com>
Reply-To: sarikaya@ieee.org
From: Behcet Sarikaya <sarikaya2012@gmail.com>
Date: Wed, 2 Sep 2020 12:37:02 -0500
Message-ID: <CAC8QAcc8cq5ff0DMD_ArSYO7E8hg1M-RDFWaJtkf8aS1j_dSeA@mail.gmail.com>
To: Eric Rescorla <ekr@rtfm.com>
Cc: Michael Richardson <mcr+ietf@sandelman.ca>, IETF SAAG <saag@ietf.org>
Content-Type: multipart/alternative; boundary="00000000000004df3805ae5816b4"
Archived-At: <https://mailarchive.ietf.org/arch/msg/saag/OWYWwxrYzRPSbzrK23yD-uTvxAM>
Subject: Re: [saag] can an on-path attacker drop traffic?
X-BeenThere: saag@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Security Area Advisory Group <saag.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/saag>, <mailto:saag-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/saag/>
List-Post: <mailto:saag@ietf.org>
List-Help: <mailto:saag-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/saag>, <mailto:saag-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 02 Sep 2020 17:37:16 -0000

On Wed, Sep 2, 2020 at 11:45 AM Eric Rescorla <ekr@rtfm.com> wrote:

> QUIC ended up with a different taxonomy:
> On-path
> Off-path
> Limited on-path (cannot delete)
>
>
Speaking of QUIC, I was surprised to read that QUIC is a UDP protocol. QUIC
document talks about
- connection establishment,
-stream based multiplexed operation,
-flow control,
-ACK frame
- on and on
are all TCP-like features.

My guess is that the mention of UDP-based was a sales-pitch :)

Behcet

> -Ekr
>
>
>
> https://datatracker.ietf.org/doc/html/draft-ietf-quic-transport-29#section-21.12.3.1
>
>
> On Wed, Sep 2, 2020 at 9:28 AM Michael Richardson <mcr+ietf@sandelman.ca>
> wrote:
>
>>
>> I think most of us agree that an "on-path" attacker can read traffic.
>> They can problem inject traffic, and maybe even inject it in such a way
>> that
>> it beats the real traffic.
>>
>> I think that most of us can agree that an off-path attacker can not read
>> traffic.
>>
>> So for instance, and on-path attacker can see the TCP SYN seq no or a DNS
>> query ID, and therefore answer correctly.
>> And off-path attacker has to depend upon implementation flaws to guess
>> those
>> values. (Which at one point were very common)
>>
>> A read-only on-path attacker that can read can be implemented with a
>> MIRROR/SPAN port.
>> Or as we learnt a few years ago with creative bending of fiber.
>>
>> A firewall or router is a potential on-path attacker, but it can also
>> drop packets.
>> What do we call this?
>> This was historically called a MITM, and it implied all the attributes of
>> on-path.  But it is unclear to me if MITM > on-path, or MITM == on-path.
>>
>> --
>> Michael Richardson <mcr+IETF@sandelman.ca>ca>, Sandelman Software Works
>>  -= IPv6 IoT consulting =-
>>
>>
>>
>> _______________________________________________
>> saag mailing list
>> saag@ietf.org
>> https://www.ietf.org/mailman/listinfo/saag
>>
> _______________________________________________
> saag mailing list
> saag@ietf.org
> https://www.ietf.org/mailman/listinfo/saag
>